Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2024-9355

Use of Uninitialized Variable

Published: Oct 01, 2024 | Modified: Oct 02, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
6.5 MODERATE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Ubuntu
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-9355
CWEhttps://cwe.mitre.org/data/definitions/457.html

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

Weakness

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Affected Software

NameVendorStart VersionEnd Version
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRedHatrhc-worker-script-0:0.10-2.el7_9*
Red Hat Enterprise Linux 8RedHatgo-toolset:rhel8-8100020241001112709.a3795dee*
Red Hat Enterprise Linux 8RedHatgrafana-0:9.2.10-20.el8_10*
Red Hat Enterprise Linux 8RedHatgrafana-pcp-0:5.1.1-9.el8_10*
Red Hat Enterprise Linux 9RedHatgolang-0:1.21.13-4.el9_4*
Red Hat Enterprise Linux 9RedHatgrafana-0:9.2.10-19.el9_4*
Red Hat Enterprise Linux 9RedHatosbuild-composer-0:132-1.el9*
Red Hat Enterprise Linux 9RedHatgit-lfs-0:3.6.1-1.el9*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatgrafana-pcp-0:5.1.1-4.el9_4*
Satellite Client 6 for RHEL 10RedHatforeman_ygg_worker-0:0.3.1-1.el10sat*
Satellite Client 6 for RHEL 8RedHatforeman_ygg_worker-0:0.3.1-1.el8sat*
Satellite Client 6 for RHEL 9RedHatforeman_ygg_worker-0:0.3.1-1.el9sat*
Streams for Apache Kafka 2.9.0RedHatgolang-github-danielqsj-kafka_exporter*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use